CVE-2021-47272 (GCVE-0-2021-47272)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:20 – Updated: 2026-05-11 13:51
VLAI
Title
usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL There exists a possible scenario in which dwc3_gadget_init() can fail: during during host -> peripheral mode switch in dwc3_set_mode(), and a pending gadget driver fails to bind. Then, if the DRD undergoes another mode switch from peripheral->host the resulting dwc3_gadget_exit() will attempt to reference an invalid and dangling dwc->gadget pointer as well as call dma_free_coherent() on unmapped DMA pointers. The exact scenario can be reproduced as follows: - Start DWC3 in peripheral mode - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs) - Run FunctionFS userspace application (open EPs, write descriptors, etc) - Bind gadget driver to DWC3's UDC - Switch DWC3 to host mode => dwc3_gadget_exit() is called. usb_del_gadget() will put the ConfigFS driver instance on the gadget_driver_pending_list - Stop FunctionFS application (closes the ep files) - Switch DWC3 to peripheral mode => dwc3_gadget_init() fails as usb_add_gadget() calls check_pending_gadget_drivers() and attempts to rebind the UDC to the ConfigFS gadget but fails with -19 (-ENODEV) because the FFS instance is not in FFS_ACTIVE state (userspace has not re-opened and written the descriptors yet, i.e. desc_ready!=0). - Switch DWC3 back to host mode => dwc3_gadget_exit() is called again, but this time dwc->gadget is invalid. Although it can be argued that userspace should take responsibility for ensuring that the FunctionFS application be ready prior to allowing the composite driver bind to the UDC, failure to do so should not result in a panic from the kernel driver. Fix this by setting dwc->gadget to NULL in the failure path of dwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out unless the gadget pointer is valid.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:39 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0 , < 851dee5a5da56564a70290713aee665403bb0b24 (git)
Affected: e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0 , < 4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8 (git)
Affected: e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0 , < 03715ea2e3dbbc56947137ce3b4ac18a726b2f87 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.44 , ≤ 5.10.* (semver)
Unaffected: 5.12.11 , ≤ 5.12.* (semver)
Unaffected: 5.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.022Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:39:38.650190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:10.857Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "851dee5a5da56564a70290713aee665403bb0b24",
              "status": "affected",
              "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
              "versionType": "git"
            },
            {
              "lessThan": "4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8",
              "status": "affected",
              "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
              "versionType": "git"
            },
            {
              "lessThan": "03715ea2e3dbbc56947137ce3b4ac18a726b2f87",
              "status": "affected",
              "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/dwc3/gadget.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.44",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL\n\nThere exists a possible scenario in which dwc3_gadget_init() can fail:\nduring during host -\u003e peripheral mode switch in dwc3_set_mode(), and\na pending gadget driver fails to bind.  Then, if the DRD undergoes\nanother mode switch from peripheral-\u003ehost the resulting\ndwc3_gadget_exit() will attempt to reference an invalid and dangling\ndwc-\u003egadget pointer as well as call dma_free_coherent() on unmapped\nDMA pointers.\n\nThe exact scenario can be reproduced as follows:\n - Start DWC3 in peripheral mode\n - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)\n - Run FunctionFS userspace application (open EPs, write descriptors, etc)\n - Bind gadget driver to DWC3\u0027s UDC\n - Switch DWC3 to host mode\n   =\u003e dwc3_gadget_exit() is called. usb_del_gadget() will put the\n\tConfigFS driver instance on the gadget_driver_pending_list\n - Stop FunctionFS application (closes the ep files)\n - Switch DWC3 to peripheral mode\n   =\u003e dwc3_gadget_init() fails as usb_add_gadget() calls\n\tcheck_pending_gadget_drivers() and attempts to rebind the UDC\n\tto the ConfigFS gadget but fails with -19 (-ENODEV) because the\n\tFFS instance is not in FFS_ACTIVE state (userspace has not\n\tre-opened and written the descriptors yet, i.e. desc_ready!=0).\n - Switch DWC3 back to host mode\n   =\u003e dwc3_gadget_exit() is called again, but this time dwc-\u003egadget\n\tis invalid.\n\nAlthough it can be argued that userspace should take responsibility\nfor ensuring that the FunctionFS application be ready prior to\nallowing the composite driver bind to the UDC, failure to do so\nshould not result in a panic from the kernel driver.\n\nFix this by setting dwc-\u003egadget to NULL in the failure path of\ndwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out\nunless the gadget pointer is valid."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:51:17.963Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
        },
        {
          "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
        }
      ],
      "title": "usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47272",
    "datePublished": "2024-05-21T14:20:01.383Z",
    "dateReserved": "2024-05-21T13:27:52.127Z",
    "dateUpdated": "2026-05-11T13:51:17.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-47272",
      "date": "2026-10-02",
      "epss": "0.00222",
      "percentile": "0.11598"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL\n\nThere exists a possible scenario in which dwc3_gadget_init() can fail:\nduring during host -\u003e peripheral mode switch in dwc3_set_mode(), and\na pending gadget driver fails to bind.  Then, if the DRD undergoes\nanother mode switch from peripheral-\u003ehost the resulting\ndwc3_gadget_exit() will attempt to reference an invalid and dangling\ndwc-\u003egadget pointer as well as call dma_free_coherent() on unmapped\nDMA pointers.\n\nThe exact scenario can be reproduced as follows:\n - Start DWC3 in peripheral mode\n - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)\n - Run FunctionFS userspace application (open EPs, write descriptors, etc)\n - Bind gadget driver to DWC3\u0027s UDC\n - Switch DWC3 to host mode\n   =\u003e dwc3_gadget_exit() is called. usb_del_gadget() will put the\n\tConfigFS driver instance on the gadget_driver_pending_list\n - Stop FunctionFS application (closes the ep files)\n - Switch DWC3 to peripheral mode\n   =\u003e dwc3_gadget_init() fails as usb_add_gadget() calls\n\tcheck_pending_gadget_drivers() and attempts to rebind the UDC\n\tto the ConfigFS gadget but fails with -19 (-ENODEV) because the\n\tFFS instance is not in FFS_ACTIVE state (userspace has not\n\tre-opened and written the descriptors yet, i.e. desc_ready!=0).\n - Switch DWC3 back to host mode\n   =\u003e dwc3_gadget_exit() is called again, but this time dwc-\u003egadget\n\tis invalid.\n\nAlthough it can be argued that userspace should take responsibility\nfor ensuring that the FunctionFS application be ready prior to\nallowing the composite driver bind to the UDC, failure to do so\nshould not result in a panic from the kernel driver.\n\nFix this by setting dwc-\u003egadget to NULL in the failure path of\ndwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out\nunless the gadget pointer is valid."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: dwc3: gadget: Bail from dwc3_gadget_exit() si dwc-\u0026gt;gadget es NULL. Existe un posible escenario en el que dwc3_gadget_init() puede fallar: durante durante el host -\u0026gt; modo perif\u00e9rico Cambie a dwc3_set_mode() y un controlador de dispositivo pendiente no se vincula. Luego, si el DRD sufre otro cambio de modo desde perif\u00e9rico-\u0026gt;host, el dwc3_gadget_exit() resultante intentar\u00e1 hacer referencia a un puntero dwc-\u0026gt;gadget no v\u00e1lido y colgante, as\u00ed como llamar a dma_free_coherent() en punteros DMA no asignados. El escenario exacto se puede reproducir de la siguiente manera: - Iniciar DWC3 en modo perif\u00e9rico - Configurar el gadget ConfigFS con la instancia FunctionFS (o usar g_ffs) - Ejecutar la aplicaci\u00f3n de espacio de usuario FunctionFS (abrir EP, escribir descriptores, etc.) - Vincular el controlador del gadget al UDC de DWC3 - Cambiar DWC3 al modo host =\u0026gt; se llama a dwc3_gadget_exit(). usb_del_gadget() colocar\u00e1 la instancia del controlador ConfigFS en gadget_driver_pending_list - Detener la aplicaci\u00f3n FunctionFS (cierra los archivos ep) - Cambiar DWC3 al modo perif\u00e9rico =\u0026gt; dwc3_gadget_init() falla ya que usb_add_gadget() llama a check_pending_gadget_drivers() e intenta volver a vincular el UDC al El gadget ConfigFS pero falla con -19 (-ENODEV) porque la instancia FFS no est\u00e1 en estado FFS_ACTIVE (el espacio de usuario a\u00fan no se ha reabierto ni escrito los descriptores, es decir, desc_ready!=0). - Vuelva a cambiar DWC3 al modo host =\u0026gt; se vuelve a llamar a dwc3_gadget_exit(), pero esta vez dwc-\u0026gt;gadget no es v\u00e1lido. Aunque se puede argumentar que el espacio de usuario debe asumir la responsabilidad de garantizar que la aplicaci\u00f3n FunctionFS est\u00e9 lista antes de permitir que el controlador compuesto se vincule al UDC, no hacerlo no deber\u00eda generar p\u00e1nico por parte del controlador del kernel. Solucione este problema configurando dwc-\u0026gt;gadget en NULL en la ruta de falla de dwc3_gadget_init() y agregue una marca a dwc3_gadget_exit() para salir del problema a menos que el puntero del gadget sea v\u00e1lido."
        }
      ],
      "id": "CVE-2021-47272",
      "lastModified": "2024-11-21T06:35:46.283",
      "published": "2024-05-21T15:15:15.687",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc3/gadget.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "851dee5a5da56564a70290713aee665403bb0b24",
                    "status": "affected",
                    "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8",
                    "status": "affected",
                    "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "03715ea2e3dbbc56947137ce3b4ac18a726b2f87",
                    "status": "affected",
                    "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/usb/dwc3/gadget.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.12.*",
                    "status": "unaffected",
                    "version": "5.12.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C7E14A6C-41D9-41C0-88FA-8959D208A792",
                    "versionEndExcluding": "5.10.44",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F914A757-FAFD-407E-9031-21F66635D5EA",
                    "versionEndExcluding": "5.12.11",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "0CBAD0FC-C281-4666-AB2F-F8E6E1165DF7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "96AC23B2-D46A-49D9-8203-8E1BEDCA8532",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DA610E30-717C-4700-9F77-A3C9244F3BFD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "1ECD33F5-85BE-430B-8F86-8D7BD560311D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:5.13:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "CF351855-2437-4CF5-AD7C-BDFA51F27683",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL\n\nThere exists a possible scenario in which dwc3_gadget_init() can fail:\nduring during host -\u003e peripheral mode switch in dwc3_set_mode(), and\na pending gadget driver fails to bind.  Then, if the DRD undergoes\nanother mode switch from peripheral-\u003ehost the resulting\ndwc3_gadget_exit() will attempt to reference an invalid and dangling\ndwc-\u003egadget pointer as well as call dma_free_coherent() on unmapped\nDMA pointers.\n\nThe exact scenario can be reproduced as follows:\n - Start DWC3 in peripheral mode\n - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)\n - Run FunctionFS userspace application (open EPs, write descriptors, etc)\n - Bind gadget driver to DWC3\u0027s UDC\n - Switch DWC3 to host mode\n   =\u003e dwc3_gadget_exit() is called. usb_del_gadget() will put the\n\tConfigFS driver instance on the gadget_driver_pending_list\n - Stop FunctionFS application (closes the ep files)\n - Switch DWC3 to peripheral mode\n   =\u003e dwc3_gadget_init() fails as usb_add_gadget() calls\n\tcheck_pending_gadget_drivers() and attempts to rebind the UDC\n\tto the ConfigFS gadget but fails with -19 (-ENODEV) because the\n\tFFS instance is not in FFS_ACTIVE state (userspace has not\n\tre-opened and written the descriptors yet, i.e. desc_ready!=0).\n - Switch DWC3 back to host mode\n   =\u003e dwc3_gadget_exit() is called again, but this time dwc-\u003egadget\n\tis invalid.\n\nAlthough it can be argued that userspace should take responsibility\nfor ensuring that the FunctionFS application be ready prior to\nallowing the composite driver bind to the UDC, failure to do so\nshould not result in a panic from the kernel driver.\n\nFix this by setting dwc-\u003egadget to NULL in the failure path of\ndwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out\nunless the gadget pointer is valid."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: dwc3: gadget: Bail from dwc3_gadget_exit() si dwc-\u0026gt;gadget es NULL. Existe un posible escenario en el que dwc3_gadget_init() puede fallar: durante durante el host -\u0026gt; modo perif\u00e9rico Cambie a dwc3_set_mode() y un controlador de dispositivo pendiente no se vincula. Luego, si el DRD sufre otro cambio de modo desde perif\u00e9rico-\u0026gt;host, el dwc3_gadget_exit() resultante intentar\u00e1 hacer referencia a un puntero dwc-\u0026gt;gadget no v\u00e1lido y colgante, as\u00ed como llamar a dma_free_coherent() en punteros DMA no asignados. El escenario exacto se puede reproducir de la siguiente manera: - Iniciar DWC3 en modo perif\u00e9rico - Configurar el gadget ConfigFS con la instancia FunctionFS (o usar g_ffs) - Ejecutar la aplicaci\u00f3n de espacio de usuario FunctionFS (abrir EP, escribir descriptores, etc.) - Vincular el controlador del gadget al UDC de DWC3 - Cambiar DWC3 al modo host =\u0026gt; se llama a dwc3_gadget_exit(). usb_del_gadget() colocar\u00e1 la instancia del controlador ConfigFS en gadget_driver_pending_list - Detener la aplicaci\u00f3n FunctionFS (cierra los archivos ep) - Cambiar DWC3 al modo perif\u00e9rico =\u0026gt; dwc3_gadget_init() falla ya que usb_add_gadget() llama a check_pending_gadget_drivers() e intenta volver a vincular el UDC al El gadget ConfigFS pero falla con -19 (-ENODEV) porque la instancia FFS no est\u00e1 en estado FFS_ACTIVE (el espacio de usuario a\u00fan no se ha reabierto ni escrito los descriptores, es decir, desc_ready!=0). - Vuelva a cambiar DWC3 al modo host =\u0026gt; se vuelve a llamar a dwc3_gadget_exit(), pero esta vez dwc-\u0026gt;gadget no es v\u00e1lido. Aunque se puede argumentar que el espacio de usuario debe asumir la responsabilidad de garantizar que la aplicaci\u00f3n FunctionFS est\u00e9 lista antes de permitir que el controlador compuesto se vincule al UDC, no hacerlo no deber\u00eda generar p\u00e1nico por parte del controlador del kernel. Solucione este problema configurando dwc-\u0026gt;gadget en NULL en la ruta de falla de dwc3_gadget_init() y agregue una marca a dwc3_gadget_exit() para salir del problema a menos que el puntero del gadget sea v\u00e1lido."
          }
        ],
        "id": "CVE-2021-47272",
        "lastModified": "2026-06-17T04:17:04.317",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2021-47272",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:39:38.650190Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-21T15:15:15.687",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-02T02:26:31+00:00",
      "cve": "CVE-2021-47272",
      "id": "CVE-2021-47272",
      "initial_release_date": "2021-01-01T00:00:00+00:00",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "196",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u0026gt;gadget is NULL",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-47272.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-02T02:19:01Z",
      "cve": "CVE-2021-47272",
      "id": "CVE-2021-47272",
      "initial_release_date": "2024-05-23T03:05:09Z",
      "product_status:known_not_affected": "385",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-47272",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2021-47272.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T05:32:08.022Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-47272",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:39:38.650190Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:15.047Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/usb/dwc3/gadget.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "851dee5a5da56564a70290713aee665403bb0b24",
                  "status": "affected",
                  "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
                  "versionType": "git"
                },
                {
                  "lessThan": "4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8",
                  "status": "affected",
                  "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
                  "versionType": "git"
                },
                {
                  "lessThan": "03715ea2e3dbbc56947137ce3b4ac18a726b2f87",
                  "status": "affected",
                  "version": "e81a7018d93a7de31a3f121c9a7eecd0a5ec58b0",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/usb/dwc3/gadget.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.10"
                },
                {
                  "lessThan": "5.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.44",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.12.*",
                  "status": "unaffected",
                  "version": "5.12.11",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.44",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.12.11",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.13",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL\n\nThere exists a possible scenario in which dwc3_gadget_init() can fail:\nduring during host -\u003e peripheral mode switch in dwc3_set_mode(), and\na pending gadget driver fails to bind.  Then, if the DRD undergoes\nanother mode switch from peripheral-\u003ehost the resulting\ndwc3_gadget_exit() will attempt to reference an invalid and dangling\ndwc-\u003egadget pointer as well as call dma_free_coherent() on unmapped\nDMA pointers.\n\nThe exact scenario can be reproduced as follows:\n - Start DWC3 in peripheral mode\n - Configure ConfigFS gadget with FunctionFS instance (or use g_ffs)\n - Run FunctionFS userspace application (open EPs, write descriptors, etc)\n - Bind gadget driver to DWC3\u0027s UDC\n - Switch DWC3 to host mode\n   =\u003e dwc3_gadget_exit() is called. usb_del_gadget() will put the\n\tConfigFS driver instance on the gadget_driver_pending_list\n - Stop FunctionFS application (closes the ep files)\n - Switch DWC3 to peripheral mode\n   =\u003e dwc3_gadget_init() fails as usb_add_gadget() calls\n\tcheck_pending_gadget_drivers() and attempts to rebind the UDC\n\tto the ConfigFS gadget but fails with -19 (-ENODEV) because the\n\tFFS instance is not in FFS_ACTIVE state (userspace has not\n\tre-opened and written the descriptors yet, i.e. desc_ready!=0).\n - Switch DWC3 back to host mode\n   =\u003e dwc3_gadget_exit() is called again, but this time dwc-\u003egadget\n\tis invalid.\n\nAlthough it can be argued that userspace should take responsibility\nfor ensuring that the FunctionFS application be ready prior to\nallowing the composite driver bind to the UDC, failure to do so\nshould not result in a panic from the kernel driver.\n\nFix this by setting dwc-\u003egadget to NULL in the failure path of\ndwc3_gadget_init() and add a check to dwc3_gadget_exit() to bail out\nunless the gadget pointer is valid."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T13:51:17.963Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/851dee5a5da56564a70290713aee665403bb0b24"
            },
            {
              "url": "https://git.kernel.org/stable/c/4aad390363d2b9b3e92428dd34d27bb7ea8f1ee8"
            },
            {
              "url": "https://git.kernel.org/stable/c/03715ea2e3dbbc56947137ce3b4ac18a726b2f87"
            }
          ],
          "title": "usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc-\u003egadget is NULL",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2021-47272",
        "datePublished": "2024-05-21T14:20:01.383Z",
        "dateReserved": "2024-05-21T13:27:52.127Z",
        "dateUpdated": "2026-05-11T13:51:17.963Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.